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IDM 30 monitors X.cl domain bank 
15 of FIG 2 to determine ADfeti^a 
pattern of payments from CI to all 
resources (i.e., Rl) in IDM 30's 
domain. 



IDM 30 compares the monitored 
pattern of payments with a pre- 
determined pattern of payments to 
determine whether the difference is 
greater than a predetermined 
difference. 



157 



IDM 30 determines that the 
monitored CI is an attacker and 
sends an attack notification to 
resource manager 12 and IRPS 34. 



IDM 30 determines that the 
Ifettmonitored CI is not an 
attacker. 
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IDM 30 monitors Y exchange bank 
1 6 of FIG 2 to determine vvtoatofi* a 
pattern of payments received by Rl 
from all clients in any domain (i.e., 
Cl). 



IDM 30 compares the monitored 
pattern of payments with a pre- 
determined pattern of payments to 
determine whether the difference is 
greater than a predetermined 
difference. 



IDM 30 determines that an 
/<-[ s \_ ^attacked has occurred and 

sends an attack notification to 
resource manager 12 and IRPS 34. 



IDM 30 determines that the 
no attack has occurred on Rl . 
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